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Introduction 

Thank you for the opportunity to talk to you today as part of the Public Office 
Holders lecture series. The theme of my talk today is how the NZSIS 
contributes towards protecting New Zealand as a free, open and democratic 
society. 

I have been in my role as Director of Security for just over two years and I think 
this is a good point to stop and reflect on the organisation that I lead. In 
particular, I want to answer three main questions over the course of this 
lecture: 

• Firstly, what are the national security challenges that we face as a 
country and how are these changing? 

• Secondly, how well equipped is the NZSIS to meet these challenges? and 

• Thirdly, how do we achieve the right balance between the need to 
maintain the secrecy necessary for us to undertake our work while also 
ensuring as much transparency and openness as we are able? 
Fundamentally, this is an issue of public confidence and trust. 

Before I seek to answer these questions I'd like to spend a bit of time going 
back to the founding legislation of the NZSIS: the New Zealand Security 
Intelligence Service Act 1969. 
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The principles that underpin the performance of functions of the NZSIS 

Contained within the 1969 Act - under the somewhat obscurely numbered 
section 4AAA(1) - are the principles that underpin the functions of the NZSIS. 
I'd like to read these principles out to you: 

(1) In performing its functions under this Act , the Security Intelligence 
Service- 

a) contributes to keeping New Zealand society secure, independent, 
and free and democratic: 

This is perhaps the most important section in the whole Act. It 
sets out in black and white that the NZSIS is here to keep New 
Zealand secure, independent, free and democratic. Everything we 
do, and the reason we exist, comes back to this primary purpose. 
It is why I was so motivated to become the Director of Security 
and why I am just as passionate about the role two years on. This 
mission - underpinned and legitimised by an Act of Parliament 
almost fifty years ago - is why my staff and I come to work each 
day. It is why some NZSIS officers are willing to undertake roles 
that put them in harm's way. They are here to help keep New 
Zealand secure and to preserve our society as free, independent 
and democratic. 

The second principle states that the NZSIS: 

b) contributes to the participation of New Zealand in the 
maintenance of international security: 

This clause is fairly self-explanatory. But it is worth noting that it 
provides for the NZSIS to contribute to international security, not 
just domestic security. 

The third principle states that the NZSIS: 

c) acts- 

i. in accordance with New Zealand law and all human rights 
standards recognised by New Zealand law, except to the 
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extent that they are, in relation to national security, 
modified by enactment: 

//'. in the discharge of its operational functions, independently 
and impartially: 

Hi. with integrity and professionalism: 

iv. in a manner that facilitates effective democratic oversight. 

This confirms for the avoidance of doubt that the NZSIS must 
always operate within the law - recognising that we have special 
but lawful powers to take actions that would otherwise not be 
legal (such as intercepting communications to find out 
information from individuals or groups that may want to do harm 
to New Zealand). 

We are also legislatively required to be impartial, independent 
and to act with integrity and professionalism. This requirement is 
embedded into the DNA of our staff. 

As you know, the Government is currently considering its response to Sir 
Michael Cullen and Dame Patsy Reddy's Independent Review of Security and 
Intelligence. As you will appreciate, I cannot comment publicly on any 
proposed changes arising from this review. Public policy, as it affects the 
NZSIS, is a matter for democratically elected members of Parliament, and the 
wider public, to consider. However, I would like to note the reviewers' 
penultimate paragraph in the foreword to their report: 

"The Act [the new single intelligence and security Act that Sir Michael 
and Dame Patsy propose] should state clearly that its fundamental 
purpose is the protection of New Zealand as a free, open and democratic 
society. That then becomes the guiding principle by which the activities 
of the agencies must be undertaken and judged." 

The threats that New Zealand faces 

Given the purpose of the NZSIS, the first question I want to address is: what 
are the threats that New Zealand faces (and, by implication, to what extent 
should New Zealand be worried by these threats)? 
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Looking globally, it is clear that the geopolitical 'tectonic plates' are shifting. 
Just like tectonic plates, when the geopolitical plates shift the world 
experiences tremors and eruptions at the fault lines. 

We see this in the Middle East with the break-down of states following the 
short-lived optimism of the Arab Spring. Most obviously we have seen a 
geopolitical eruption with the rise of ISIL. 

But it is not only in the Middle East. We are also seeing the resurgence of a 
more aggressive Russia, as seen in Crimea, Ukraine, Syria and elsewhere. The 
repositioning of the major powers is also playing out in areas like the South 
China Sea. 

Of course, countries outside of these immediate hot spots are not immune. 
The struggle for geopolitical influence extends around the globe, including 
regions close to us like South East Asia and the Pacific. Additionally, the 
internet and social media have broken down geographic boundaries like never 
before, meaning that cyber attacks, cyber espionage, and radicalisation can 
happen anywhere in the world with the click of a button. 

That is true for New Zealand, and means that we face security threats like 
every other country. In some areas, such as counter-terrorism, we are still 
comparatively fortunate. New Zealand has not suffered an attack at the hands 
of the so-called Islamic State, or Da'esh, unlike similar countries such as 
Australia and Canada. The New Zealand national threat level is LOW, meaning 
"a terrorist attack ... is assessed as possible, but is not expected." I am 
confident that the LOW threat assessment remains appropriate, although I 
think it is also fair to say that while the overall number of individuals of 
concern remains small, there is a higher proportion of more concerning 
individuals than there were 18 months ago. 

I have sometimes been asked why we treat terrorist threats differently from 
other violent or criminal matters. After all, many people die each year from 
violent assaults. My answer is that the purpose of a terrorist attack, as its 
name suggests, is to cause terror among the populace. So not only is terrorism 
a calculated and targeted act of violence against civilians, but it is also a 
symbolic act against the value system of the nation, and that is why it is a 
concern to a security intelligence organisation. 
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For me, one of the things that I love about living in New Zealand is that we can 
walk the streets free from the fear of the type of events that have happened in 
Paris, Brussels, Ottawa, London and Sydney. Mostly people go about their lives 
without worrying that such events could happen here. 

As I have said, the chances are indeed low and that is wonderful. But ultimately 
it is my job, and the job of my organisation, to do everything we can to keep it 
this way. As I have said before, it is our job to worry so you don't have to. Of 
course there can be no guarantees, but a professional, competent security 
agency is a vital part in the government's armour in keeping New Zealand 
secure. 

In talking about terrorism I would like to make the point - which I have 
regularly made although it is never reported - that terrorism is not a 'Muslim' 
issue. In a recent North and South issue focused on radical Islam, a member of 
the Muslim community was reported as saying that within any religion there 
are fanatics who "steal" the faith or exploit it for political gain. She said 
"People say they are afraid of Muslims because they think ISIS represents 
Muslims. That's what they think. But that's only valid if you say that the KKK 
represents Christianity. If only they could see what ISIS is doing to the Muslim 
world, what they're doing in my home country Iraq ..." 

The Muslim community leaders that I have spoken with have stressed that the 
sort of individuals who are of interest to the NZSIS do not adhere to the 
interpretation of Islam that represents the vast majority of New Zealand's 
Muslim population. Using Islam as a justification for violent acts is abhorrent to 
the vast majority of New Zealand Muslims, who contribute so much to this 
country. Identifying the underlying causes of radicalisation is the subject of a 
lot of research internationally, but at least some radicalised individuals are 
youths who are misguidedly searching for a meaningful cause and who are 
susceptible to very calculated extremist grooming. 

The unfortunate reality is that a terrorist event in New Zealand would probably 
have a very negative impact on New Zealand Muslims, because of the likely 
public backlash. The experience of other countries is that this backlash in turn 
can create a negative spiral of distrust and alienation, which creates a fertile 
ground for further radicalisation. 
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Avoiding such a situation is strongly in the interests of both the NZSIS and the 
Muslim community. That community is an important part of the New Zealand 
population that my agency serves. 

I believe that we should collectively do all we can to keep a small number of 
people from threatening our way of life, our diverse communities, and the 
values - such as inclusiveness and trust - that we cherish so much. 

Unsurprisingly, given overseas experience, the NZSIS puts a lot of effort into 
counter-terrorism, but we are also focused on other significant threats. New 
Zealand's key institutions - government departments and major businesses - 
are far more likely to be threatened by those seeking to steal their information 
and data than they are from a terrorist attack. Countering espionage and 
helping institutions protect their people, information and assets are also 
significant, if under-reported, parts of our work. The NZSIS plays a key role in 
vetting people whose work requires them to access the most sensitive 
government information. We also run the whole-of-government Protective 
Security Requirements (PSR). The PSR includes mandatory security 
requirements for 36 government agencies. It is designed to help agencies work 
out what security threats face their people (and people who interact with 
them), their assets and their information. We then help agencies figure out 
what they can do to keep themselves more secure. The PSR is available on-line 
and it is also being used by non-government organisations and companies in 
the private sector as an accessible and practical framework to assess and 
improve security. 

How well placed is the NZSIS to respond to these threats? 

Considering the nature of current and likely future threats, the next obvious 
question is: how well placed is the NZSIS to help keep New Zealand society 
secure? 

When I started as Director of Security two years ago, it was on the back of a 
State Services Commission-sponsored Performance Improvement Framework 
report. I think a polite summary of the report was that the NZSIS, along with 
the wider New Zealand Intelligence Community, had many 'challenges'. In 
reality the Performance Improvement Framework showed that this was an 
organisation that had major short-comings. 
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With the benefit of hindsight, the secrecy that the NZSIS had operated under 
since its inception had, in some respects, done it considerable damage. 

Because of its impenetrable exterior and isolation, I don't think anybody was 
aware how far it had fallen behind over a period of decades, in terms of the 
systems, policies and procedures that one would find in any modern 
organisation. 

So the last two years have involved a significant series of internal 
improvements within the NZSIS. In almost every aspect, from strategy and 
planning to HR and finance systems, to introducing a proper compliance 
framework, we are building or rebuilding core systems. Moreover, we have 
had to do this while the operational tempo has never been greater. To give you 
a sense of this, when I first applied for the job, no one had heard of ISIL, 
terrorism hardly featured in my job interview, and even the Performance 
Improvement Framework report devoted only a handful of words to the issue. 
Since then the NZSIS has been transformed from having a 5 day a week, 9 to 5 
operation to an organisation that is regularly operating 24/7. 

You will all have heard, no doubt, about the additional investment that the 
NZSIS received in Budget 2016. This investment was made following a rigorous 
process, because the Minister of Finance sets a very high bar for Budget bids. 
The New Zealand Intelligence Community developed its capability bid 
collectively over two years, involving more than 20,000 hours of work. One of 
the benefits of this process is that I suspect that the New Zealand Intelligence 
Community knows its business better than just about any other government 
department. 

The money represents, I think, an endorsement from Ministers in the direction 
that the NZSIS is heading, a confidence that we can deliver and a clear 
expectation that we will need to continue to lift our ability to keep New 
Zealanders secure. 

The additional investment will enable us, firstly, to continue our programme of 
ensuring that our core systems are fit-for-purpose and able to support the 
demands of a modern business; and secondly, to grow our capability to 
respond to the threats we are facing. 
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For obvious reasons I can't specify in detail where the investment will be 
targeted. But some of the operational areas in which we will invest include: 

• additional investigators and collection staff to increase coverage of 
domestic and international security threats, including counter-terrorism, 
counter-espionage and counter-intelligence; and 

• ensuring that government departments' systems, people and 
communications are protected, including making the vetting process 
more effective, efficient and customer-focused. 

It will take us the full four years of the investment pathway to safely and 
successfully grow our capabilities. But at the end of that time we will be in a 
significantly better position to meet the demands we face and the 
technological support we need to do our work. 

How do we ensure public confidence and trust when much of our work is 
secret? 

The final question that I wish to answer is: how do we ensure public 
confidence and trust when much of our work necessarily has to be carried out 
away from the public spotlight? 

The reality is that the NZSIS cannot disclose a lot of what it does publicly. 

There are several reasons for this. The first is security. The NZSIS has lawful, 
covert capabilities to find out information that individuals or groups do not 
want us to know - such as their intention to carry out acts of terror or to steal 
information. The more we say about the people we are investigating, and the 
particular approaches we use to find out information, the more our 
adversaries will learn and adapt. One of the consequences of the Snowden 
leaks is that it is now standard for our targets to use encrypted 
communications, making it harder for us to understand their intentions and 
motivations. So security is a big reason for not providing detailed information 
about our work. 

Another reason is privacy. We are often dealing with incomplete information 
about individuals. In many cases we are combining snippets of information 
and strands of intelligence to build up a coherent intelligence picture, which 
can be especially challenging when these individuals are often actively trying to 
conceal their activities. A picture may emerge that a person is definitely of 
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security concern, but in other cases the investigation ends when we rule an 
individual out in terms of being of security interest, much in the same way a 
criminal investigation by Police seeks to rule out suspects. Keeping secret 
means that we can determine that individuals are not of concern without the 
loss of privacy that would occur if we had publicly identified them or provided 
enough information that they were able to be publicly identified. 

So, if secrecy will continue to play a significant part in what we do, how do we 
ensure the appropriate level of transparency and openness, and how do we 
create public trust? I'd like to propose five ways: 

• Firstly, I think that as Director of Security, I have a responsibility to 
communicate in fora such as this about the work that we do and why it 
matters. It is about openly and honestly explaining what we do and the 
checks and balances that we operate under. 

It is about explaining that while the work we do is undoubtedly "beyond 
ordinary" - it is "cool" working on the kinds of things we are asked to do 
- our work is underpinned by agency systems and processes that are, in 
most ways, as normal as any other government department (although I 
don't think I'll ever quite get used to having the blinds down on all the 
windows and not being able to have my mobile with me at work). The 
fact is that the NZSIS is a normal part of the state, which is why our 
legislation dates back almost fifty years and the NZSIS itself is coming up 
for its sixtieth birthday. 

It is also about ensuring that we openly and transparently respond to 
Privacy Act and Official Information Act requests and proactively put as 
much information into the public domain as possible. So, for example, 
we will be releasing publicly a summary of the New Zealand Intelligence 
Community's Four Year Plan and redacted versions of the 2016 Budget 
Bid Cabinet papers as part of Treasury's proactive OIA release. This will 
be a first for the Intelligence Community and a further step towards us 
being as open and transparent as we can. 
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• Secondly, while the public cannot see everything that we do, we have 
independent overseers who can. The Inspector-General of Intelligence 
and Security - or the "IGIS" as she is commonly known in the 
Intelligence Community - has the primary role as the 'watcher of the 
watchers'. She can and does investigate what we do and makes her 
findings and recommendations public. The publication of those reports 
can be painful for us, especially while we are in the process of 
addressing the underlying problems, but I have no doubt that the 
Inspector-General's constant gaze keeps us focused and motivated to 
improve. On behalf of the public, the Inspector-General beams the 
sunshine into the intelligence agencies that is the best disinfectant. 

But it would be both simplistic and unsatisfactory to characterise the 
situation as one where public trust rests upon the Inspector-General's 
ability to investigate an untrustworthy NZSIS. Such a characterisation 
would be inaccurate for several reasons. 

For a start, it puts unrealistic expectations and responsibilities on the 
Inspector-General. It is not physically possible for her and her staff to 
review every single thing that we do. The Inspector-General does 
undertake detailed investigations, and they are very important, but her 
influence is more profound and widespread than that. She is interested 
in more than specific operations or warrants; her focus is also on our 
work at a system level. She wants to know that our underlying policies 
and processes are robust enough to ensure that we are effective and 
compliant. 

She also has a very significant influence at a cultural level. Within the 
NZSIS we all know that she may choose to review or investigate anything 
we are working on. Her ability to investigate anything means that we are 
always asking the IGIS question. It is the equivalent of the public service 
'Dominion Post test': what would the IGIS think of this? I regularly hear 
my staff ask this question in the context of decisions they are taking, and 
I regularly ask myself the same question. I sometimes think of it as the 
"IGIS on my shoulder". This means that the Inspector-General's 
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influence is culturally profound, and more far-reaching than the specific 
investigations she and her staff undertake. 

• My third point about how we create public trust and confidence is 
connected to this. Our great systems, processes and people need to be 
evident to everybody who comes across us, whether it's independent 
reviewers like the Performance Improvement Framework teams, the 
Auditor-General, independent reviewers, Ministers, the Leader of the 
Opposition, journalists, members of the public with whom we interact, 
or those reading our Annual Report. Our story should be consistent, and 
based on facts that we are proud of and for which we have evidence. 

And as we strengthen our foundations I feel increasingly confident about 
that narrative. In many areas - and particularly those involving intrusive 
capabilities and formal legal authorisation - our processes are already 
strong. For example, except in certain cases of particular urgency (which 
I won't go into here), the process to obtain an intelligence warrant 
involves putting together a meticulously crafted application where each 
statement is supported by carefully documented and assessed 
intelligence, review by our in-house lawyers, sign-off at the Deputy 
Director level, a full review by me as Director followed by my affirmation 
before an external lawyer that the content of the application is true to 
the best of my knowledge, a further review (in the case of a domestic 
interception warrant) by the Commissioner of Security Warrants, and 
then joint approval by the Commissioner and the Minister In Charge of 
the NZSIS. Every warrant is inspected after the fact by the Office of the 
Inspector-General. 

That is one example of careful process. But systems and procedures are 
only as good as the staff who follow them. That is why trust and integrity 
are "baked in" to our recruitment processes. When NZSIS recruits, we 
require candidates to go through a highly intrusive vetting process: we 
ask about everything from their most detailed financial information to 
their personal relationships. The purpose of the vetting process, as 
outlined by the Protective Security Requirements, is to ensure that the 
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people who have access to the most sensitive classified information are 
not open to coercion or blackmail, and are trustworthy. We also need to 
model integrity at every level of the organisation. 


From the day I started I have always been impressed by the level of care 
shown by my staff. But it is not just attention to detail or to the letter of 
the law, it is also hard-wired into the culture of the organisation to ask 
always whether an investigation or a form of collection is necessary and 
proportionate. I can think of an example that happened within the last 
year where the Deputy Director responsible for the intelligence 
directorate approached me with a warrant involving a particularly 
intrusive form of surveillance. The Deputy Director said that he 
supported the use of this form of intelligence collection, and considered 
that it was both legal and proportionate. He wanted me to know, 
however, that there had been a lot of internal debate in his team. He 
suggested that I speak with one of the managers who had a different 
perspective - not about legality, but about proportionality - as to 
whether the proposed way forward was justified in all the 
circumstances. I then had a separate, one-on-one conversation with that 
manager, and she had a very thoughtful and valid perspective. Then I 
slept on it. The result of hearing both sides of the issue was that we did 
undertake the surveillance operation, but we made a number of 
modifications to our approach. We reduced the length of time for which 
the warrant was sought and introduced a mandatory weekly review to 
determine whether the warrant should be continued or cancelled, 
depending on the value of the intelligence being collected and any other 
relevant factors. In the end, the form of collection did prove its worth, 
but the surveillance was only required for a matter of weeks and after 
that the warrant was cancelled. I thought that this was a sign of a 
healthy organisational culture, in which we encourage every person to 
ask the hard questions and we actively seek different perspectives. 

• The fourth way in which we build public trust and confidence is by 
owning our mistakes. No organisation is perfect and ours isn't either. 
Especially while we are still in the process of improving our systems - 
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and growing at the same time - we have and will make mistakes. 
Something I learned from Sir Jerry Mateparae is the phrase "Own it, fix 
it, learn from it and move on." I think that applies as much at the 
organisational level as it does at the individual level. Acknowledging our 
mistakes honestly and learning from them is essential. 

Final thoughts 

I've traversed a lot of ground during this talk, including the legislative basis that 
defines our work, the threats facing our country, the capability requirements 
of the NZSIS, and fundamental questions about the balance between secrecy 
and transparency. 

As I have said, one of the difficulties of my role is working out how much 
information I can publicly reveal. Every time I deny something, I implicitly 
confirm something else later on if I don't deny this also. A lack of denial is 
automatically taken as confirmation, but sometimes I am not in a position to 
explain the actual situation because it involves delicate sources or classified 
information. So how to correct inaccuracies can be a real challenge. 

Most recently this problem played out in the case of the "jihadi brides" (as 
they are colloquially known around the world). There were limits on what I 
could say publicly, in particular in this case because some relevant information 
had come from partner agencies, and it took time to get their permission to 
release it. The result was that some people questioned my integrity, which 
goes to who I am and the values to which I adhere as a public servant. It 
doesn't mean I will never make mistakes or make the wrong judgement calls. 
But I believe absolutely in the impartiality and independence of my role. 
Moreover, as I explained at the start of this lecture, that impartiality is more 
than a moral or ethical imperative, it is a legal one too. 

When the jihadi bride media storm was at its height, a long-serving staff 
member, who has been in the Service for 32 years and worked for five 
directors during her time said to me: "well, you're experiencing what all of 
your predecessors have experienced. They all arrived with the intention of 
increasing transparency and all of them threw up their hands and said it's just 
too hard." 
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I have a lot of sympathy for my predecessors - believe me! - but times have 
changed and I understand clearly that public support and our authorising 
environment depend very much on our providing greater openness and 
transparency. I hope that the greater public engagement that the Director of 
the GCSB and I have been undertaking will help us as a country to have a more 
measured, better informed public debate and discussion about the issues 
involving security and intelligence. As part of that increasing maturity, I want to 
get beyond being caricatured as either the "hero" or the "zero." I am neither. I 
am a public servant doing the best job I can to lead an organisation mandated 
by Parliament to do its work. And my staff are neither Inspector Clouseau nor 
James Bond. They are dedicated, hard-working New Zealanders that go the 
extra mile to keep New Zealand and New Zealanders safe and secure. They do 
work in an environment that is beyond ordinary, and many of them have skills 
and attributes that are also beyond ordinary. Because they operate in a 
complex operational environment they will sometimes make mistakes. But 
overwhelmingly the work they do is valuable and useful. 

That's why giving lectures such as this one is so important. Not everyone will 
always 'get' what we do, understand why it matters, or really appreciate the 
difficulties of working in a covert environment. Some people will always 
misrepresent what we do or be opposed to our existence. But I am confident 
that most of the public understand our value and why we are needed. We see 
this every day when we ask members of the public to help us and they are 
happy to do so. That public support was confirmed a couple of years ago in 
some polling undertaken by the New Zealand Intelligence Community, which 
showed that over 76% of New Zealanders believe that NZSIS is "good" or "very 
good" for New Zealand. 

So today is another step in explaining what we do and why it matters. 

Hopefully you have a better sense of the NZSIS and the role we play in keeping 
New Zealand society secure, free, open and democratic. 

Thank you for your time. 
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